name: trace exec
description: trace process executions
tracers:
  exec:
    mapName: events
    structName: event
structs:
  event:
    fields:
    - name: timestamp
      attributes:
        template: timestamp
    - name: pid
      attributes:
        template: pid
    - name: ppid
      attributes:
        template: pid
    - name: comm
      attributes:
        template: comm
    - name: uid
      attributes:
        template: uid
    - name: gid
      attributes:
        template: uid
    - name: loginuid
      description: 'TODO: Fill field description'
      attributes:
        width: 16
        alignment: left
        hidden: true
        ellipsis: end
    - name: sessionid
      description: 'TODO: Fill field description'
      attributes:
        width: 16
        alignment: left
        hidden: true
        ellipsis: end
    - name: retval
      description: 'TODO: Fill field description'
      attributes:
        width: 3
        alignment: left
        ellipsis: end
    - name: args_count
      description: 'TODO: Fill field description'
      attributes:
        width: 16
        alignment: left
        hidden: true
        ellipsis: end
    - name: args_size
      description: 'TODO: Fill field description'
      attributes:
        width: 16
        alignment: left
        hidden: true
        ellipsis: end
    - name: args
      description: 'TODO: Fill field description'
      attributes:
        width: 16
        alignment: left
        hidden: true
        ellipsis: end
    - name: mntns_id
      description: Mount namespace inode id
      attributes:
        template: ns
    - name: upper_layer
      description: Whether the executable is in the upper layer of the overlay filesystem
      attributes:
        width: 5
        alignment: left
        ellipsis: end
ebpfParams:
  ignore_failed:
    key: ignore-failed
    defaultValue: "true"
    description: Ignore failed events
  targ_uid:
    key: uid
    defaultValue: ""
    description: Show only events generated by processes with this uid
